Analysis
-
max time kernel
64s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
22/11/2022, 02:03
Static task
static1
Behavioral task
behavioral1
Sample
ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
-
Target
ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe
-
Size
518KB
-
MD5
ca74ebe87b94204f5a848d22c266f678
-
SHA1
f1964b8c906e4e55bf4337373f21664ab797bd54
-
SHA256
ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba
-
SHA512
c39a8c35aa4a1fba67114816778df733c7fed9c63f7551283a470f9a5e175c4a421de6eaba5934b1cede27d19dc9b95f4c196c3175dc64dfdb8b37323b5450ae
-
SSDEEP
12288:9uYGYTbT6bC0eceS1JwYYlLPt5oKnWq3Ub:4YpTboCgWlLPt5/WF
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 924 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 28 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29 PID 1996 wrote to memory of 960 1996 ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe"C:\Users\Admin\AppData\Local\Temp\ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exestart2⤵PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\ba8c51d41540639f76b41e753c659db83405ac36fc53f2af9a6065208b2136ba.exewatch2⤵PID:960
-